5963 matches found
Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities due to Apache Log4j ( CVE-2026-34477, CVE-2026-34478, CVE-2026-34479 & CVE-2026-34480 )
Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities due to Apache Log4j. Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addresse...
CRLF Injection
Overview symfony/mime is a library to manipulate MIME messages. Affected versions of this package are vulnerable to CRLF Injection due to improperly validating user input specifically carriage return and line feed bytes within the Symfony\Component\Mime\Address constructor. The constructor accept...
MAL-2026-4557 Malicious code in ezymail (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea463f516048086ec4acfc2733edc9561dac749d19c2e47381fc170c451cd53c The package advertises itself as a Gmail/SMTP sender library. The README documents that callers pass their SMTP user and pass Gmail App Password to a...
OPENSUSE-SU-2026:20784-1 Security update for nginx
This update for nginx fixes the following issues: - CVE-2026-1642: plain text data injection into the response from an upstream proxied server bsc1257675. - CVE-2026-27654: buffer overflow in the NGINX worker process via the ngxhttpdavmodule module bsc1260416. - CVE-2026-27784: NGINX worker memor...
Exploit for CVE-2026-45185
CVE-2026-45185 Nuclei Template Validation Lab This repository...
Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes
Summary The Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". The same applies to the HTTP /api/v1/send endpoint, whose request body is...
CVE-2026-33234 AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.1.0 through 0.6.51, SendEmailBlock in autogptplatform/backend/backend/blocks/emailblock.py accepts a user-supplied smtpserver string and smtpport integer as...
CVE-2026-33234
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.1.0 through 0.6.51, SendEmailBlock in autogptplatform/backend/backend/blocks/emailblock.py accepts a user-supplied smtpserver string and smtpport integer as...
CVE-2026-33234
CVE-2026-33234 affects AutoGPT versions 0.1.0–0.6.51, where SendEmailBlock accepts user-provided smtp_server and smtp_port and passes them to Python’s smtplib.SMTP() without IP address validation. This bypasses hardened SSRF protections (validate_url_host and BLOCKED_IP_NETWORKS) used by other bl...
CVE-2026-33234 AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.1.0 through 0.6.51, SendEmailBlock in autogptplatform/backend/backend/blocks/emailblock.py accepts a user-supplied smtpserver string and smtpport integer as...
CVE-2026-33234 AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.1.0 through 0.6.51, SendEmailBlock in autogptplatform/backend/backend/blocks/emailblock.py accepts a user-supplied smtpserver string and smtpport integer as...
GHSA-C54J-XP92-WH28 Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
Summary The POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware, allowing any user with builder permissions to access it. When SMTP email is not configured the default for self-hosted Budibase instances, this endpoint bypasses the admin-restricted invite flo...
CVE-2026-46364
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector and BuiltinCaptcha::saveCaptcha methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captc...
@cedarjs/studio (>=1.0.0, <=2.0.1), @donswayo/wildduckiu (>=1.30.3, <=1.30.6) +65 more potentially affected by CVE-2026-38728 via smtp-server (>=3.0.1, <=3.18.2)
smtp-server NPM version =3.0.1, =1.0.0, =1.30.3, =1.40.10, =8.0.1, =7.0.0, =1.1.0, =5.8.38, =5.8.40 and more Source cves: CVE-2026-38728 Source advisory: OSV:GHSA-FV2F-RW9F-V9CM...
GHSA-FV2F-RW9F-V9CM smtp-server's command parser memory exhaustion denial-of-service
smtp-server prior to v3.18.3 are vulnerable to unauthenticated memory exhaustion denial-of-service. smtp-server's command parser allows any remote client to consume server memory by sending data without newline characters. The server's remainder buffer in SMTPStream.write grows without limit,...
Allocation of Resources Without Limits or Throttling
Overview smtp-server is a Create custom SMTP servers on the fly Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the SMTPStream.write process. An attacker can cause excessive memory consumption and potentially crash the server by...
@cedarjs/studio (>=1.0.0, <=2.0.1), @donswayo/wildduckiu (>=1.30.3, <=1.30.6) +65 more potentially affected by CVE-2026-38728 via smtp-server (>=3.0.1, <=3.18.2)
smtp-server NPM version =3.0.1, =1.0.0, =1.30.3, =1.40.10, =8.0.1, =7.0.0, =1.1.0, =5.8.38, =5.8.40 and more Source cves: CVE-2026-38728 Source advisory: SNYK:JS-SMTPSERVER-17705947...
CVE-2026-38728
An issue in Nodemailer smtpserver before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream.write, lib/smtp-stream.js components...
smtp-server 资源管理错误漏洞
smtp-server is an open-source Node.js module developed by nodemailer, used to create SMTP and LMTP server instances. Versions of smtp-server prior to 3.18.3 contained a resource management vulnerability. This vulnerability stemmed from issues with the SMTPStream.write and lib/smtp-stream.js...
